Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (52 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2021-40143 1 Sonatype 1 Nexus Repository Manager 3 2024-11-21 8.2 High
Sonatype Nexus Repository 3.x through 3.33.1-01 is vulnerable to an HTTP header injection. By sending a crafted HTTP request, a remote attacker may disclose sensitive information or request external resources from a vulnerable instance.
CVE-2021-37152 1 Sonatype 1 Nexus Repository Manager 2024-11-21 5.4 Medium
Multiple XSS issues exist in Sonatype Nexus Repository Manager 3 before 3.33.0. An authenticated attacker with the ability to add HTML files to a repository could redirect users to Nexus Repository Manager’s pages with code modifications.
CVE-2021-34553 1 Sonatype 1 Nexus Repository Manager 2024-11-21 4.3 Medium
Sonatype Nexus Repository Manager 3.x before 3.31.0 allows a remote authenticated attacker to get a list of blob files and read the content of a blob file (via a GET request) without having been granted access.
CVE-2021-30635 1 Sonatype 1 Nexus Repository Manager 2024-11-21 5.3 Medium
Sonatype Nexus Repository Manager 3.x before 3.30.1 allows a remote attacker to get a list of files and directories that exist in a UI-related folder via directory traversal (no customer-specific data is exposed).
CVE-2021-29159 1 Sonatype 1 Nexus Repository Manager 2024-11-21 6.1 Medium
A cross-site scripting (XSS) vulnerability has been discovered in Nexus Repository Manager 3.x before 3.30.1. An attacker with a local account can create entities with crafted properties that, when viewed by an administrator, can execute arbitrary JavaScript in the context of the NXRM application.
CVE-2021-29158 1 Sonatype 1 Nexus Repository Manager 3 2024-11-21 4.9 Medium
Sonatype Nexus Repository Manager 3 Pro up to and including 3.30.0 has Incorrect Access Control.
CVE-2020-29436 1 Sonatype 1 Nexus Repository Manager 2024-11-21 6.5 Medium
Sonatype Nexus Repository Manager 3.x before 3.29.0 allows a user with admin privileges to configure the system to gain access to content outside of NXRM via an XXE vulnerability. Fixed in version 3.29.0.
CVE-2020-24622 1 Sonatype 1 Nexus 2024-11-21 4.9 Medium
In Sonatype Nexus Repository 3.26.1, an S3 secret key can be exposed by an admin user.
CVE-2020-15871 1 Sonatype 1 Nexus Repository Manager 3 2024-11-21 8.8 High
Sonatype Nexus Repository Manager OSS/Pro version before 3.25.1 allows Remote Code Execution.
CVE-2020-15870 1 Sonatype 1 Nexus Repository Manager 3 2024-11-21 6.1 Medium
Sonatype Nexus Repository Manager OSS/Pro versions before 3.25.1 allow XSS (Issue 2 of 2).
CVE-2020-15869 1 Sonatype 1 Nexus Repository Manager 3 2024-11-21 5.4 Medium
Sonatype Nexus Repository Manager OSS/Pro versions before 3.25.1 allow XSS (issue 1 of 2).
CVE-2020-15868 1 Sonatype 1 Nexus Repository Manager 2024-11-21 7.5 High
Sonatype Nexus Repository Manager OSS/Pro before 3.26.0 has Incorrect Access Control.
CVE-2020-15012 1 Sonatype 1 Nexus Repository Manager 2024-11-21 8.6 High
A Directory Traversal issue was discovered in Sonatype Nexus Repository Manager 2.x before 2.14.19. A user that requests a crafted path can traverse up the file system to get access to content on disk (that the user running nxrm also has access to).
CVE-2020-11753 1 Sonatype 1 Nexus Repository Manager 3 2024-11-21 8.8 High
An issue was discovered in Sonatype Nexus Repository Manager in versions 3.21.1 and 3.22.0. It is possible for a user with appropriate privileges to create, modify, and execute scripting tasks without use of the UI or API. NOTE: in 3.22.0, scripting is disabled by default (making this not exploitable).
CVE-2020-11444 1 Sonatype 1 Nexus 2024-11-21 8.8 High
Sonatype Nexus Repository Manager 3.x up to and including 3.21.2 has Incorrect Access Control.
CVE-2020-11415 1 Sonatype 1 Nexus Repository Manager 2024-11-21 4.9 Medium
An issue was discovered in Sonatype Nexus Repository Manager 2.x before 2.14.17 and 3.x before 3.22.1. Admin users can retrieve the LDAP server system username/password (as configured in nxrm) in cleartext.
CVE-2020-10204 1 Sonatype 1 Nexus 2024-11-21 7.2 High
Sonatype Nexus Repository before 3.21.2 allows Remote Code Execution.
CVE-2020-10203 1 Sonatype 1 Nexus 2024-11-21 4.8 Medium
Sonatype Nexus Repository before 3.21.2 allows XSS.
CVE-2019-9630 1 Sonatype 1 Nexus Repository Manager 2024-11-21 N/A
Sonatype Nexus Repository Manager before 3.17.0 has a weak default of giving any unauthenticated user read permissions on the repository files and images.
CVE-2019-9629 1 Sonatype 1 Nexus Repository Manager 2024-11-21 N/A
Sonatype Nexus Repository Manager before 3.17.0 establishes a default administrator user with weak defaults (fixed credentials).